Privacy Policy
How we collect, use, and protect personal information.
1. Introduction
Welcome to Toothpick (“Toothpick”, “we”, “our”, or “us”).
Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you access or use our websites, mobile applications, digital platforms, and related services (collectively, the “Services”).
By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
Toothpick is a healthcare technology group providing digital solutions across multiple markets. Our Services include healthcare marketplace solutions, financing-related digital services, and technology solutions connecting users with relevant partners and service providers.
Toothpick Holding Limited, registered in Abu Dhabi Global Market (ADGM), Abu Dhabi, United Arab Emirates, is the holding company of the Toothpick group.
Depending on the Service you access and the country in which the Service is provided, your personal information may be processed by the relevant Toothpick group entity responsible for providing that Service.
Registered Address
Abu Dhabi Global Market, Abu Dhabi, United Arab Emirates
3. Scope
This Privacy Policy applies to personal information processed through Toothpick’s Services, including, where applicable:
- Toothpick websites and mobile applications
- Marketplace and e-commerce services
- Financing-related digital services and application journeys
- Clinic, supplier, distributor, and partner portals
- Customer support channels
- Other digital services made available by Toothpick
This Privacy Policy applies where Toothpick determines the purposes and means of processing personal information. Where a third-party partner processes information independently under its own terms and privacy policy, that third party is responsible for its respective processing activities.
4. Information We Collect
The information we collect depends on how you interact with our Services and the features you use.
A. Personal Information. We may collect information such as:
- Full name
- Contact information
- Address
- Email address
- Telephone number
B. Account Information. Where you create or access an account, we may collect:
- Login history
- Authentication information
- Account preferences
- Information associated with your account and use of the Services
C. Technical and Usage Information. When you access or use our Services, we may automatically collect certain technical information, including:
- Device identifiers
- Browser type
- Operating system
- Mobile device model
- Crash logs
- Application version
- Cookies and similar technologies
- Session information
- Information relating to how you interact with our Services
D. Location Information. Where permitted by applicable law and enabled by you, we may collect:
- GPS location
- Approximate location
- Country
- Time zone
You may be able to manage access to precise location information through your device settings.
E. Payment and Transaction Information. Where transactions or payments are facilitated through our Services, we may collect:
- Transaction history
- Order and purchase information
- Payment status and related transaction references
- Information necessary to facilitate or reconcile transactions
Payment card information may be processed directly by authorized payment service providers. Toothpick does not store full payment card information unless specifically required and permitted by applicable law.
5. Data Minimization
We collect only the personal information that is reasonably necessary to provide and operate the Services, manage user accounts, facilitate orders and transactions, support financing-related journeys where applicable, and meet applicable legal or regulatory requirements.
We seek to avoid collecting personal information that is not relevant to the specific purpose for which it is required. Where information is collected for a defined purpose, we limit its use to that purpose or other compatible purposes permitted by applicable law.
We periodically review the categories of personal information we collect to assess whether they remain relevant and necessary. Personal information is retained only for as long as required for the relevant purpose or as otherwise required by applicable law.
6. How We Collect Information
We may collect personal information:
- Directly from you when you create an account, submit information, place an order, complete a form, or otherwise interact with our Services
- Automatically through your use of our websites, applications, and digital platforms
- From payment service providers and other service providers involved in facilitating transactions
- From financing partners where necessary to support a financing journey and where permitted by applicable law
- Through cookies and similar technologies
- Through customer support interactions
- From business partners where necessary to provide a Service requested by you
7. How We Use Your Information
We may process personal information to:
- Create and manage your account
- Verify your identity where necessary
- Facilitate orders and transactions
- Enable access to relevant platform features
- Facilitate interactions with financing or payment partners where requested by you
- Process or facilitate payments
- Provide customer support
- Administer our contractual relationships
- Maintain the functionality and integrity of our Services
- Fulfil other purposes communicated to you at the time your information is collected
Where required by applicable law, we will obtain consent before using personal information for a purpose that requires consent.
8. Legal Basis for Processing
Where applicable law requires a legal basis for processing personal information, we may rely on one or more of the following:
- Your consent
- Performance of a contract with you or steps taken at your request before entering into a contract
- Compliance with applicable legal obligations
- Our legitimate interests, where those interests are not overridden by your rights and interests
- Other lawful grounds available under applicable data protection legislation
Where consent is the applicable legal basis, you may withdraw your consent at any time, subject to applicable legal requirements. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
9. Sharing Your Information
We may share personal information where necessary with:
- Payment processors and payment service providers
- Financing partners where you choose to access a financing service
- Cloud hosting and infrastructure providers
- IT and technology service providers
- Analytics and platform performance providers
- Communication service providers
- Professional advisers and other service providers where necessary for legitimate business purposes
Where information is shared with a third-party service provider acting on our behalf, we require appropriate contractual and confidentiality protections consistent with applicable law.
Where you choose to use a service offered by an independent third party through the Toothpick platform, that third party may process your information in accordance with its own privacy policy and applicable legal obligations.
We do not sell your personal information.
10. Data Location and International Transfers
Toothpick seeks to process and store personal information within the jurisdiction or approved hosting environment applicable to the relevant Service.
We do not transfer your personal information internationally unless such a transfer becomes necessary for the provision of a Service, is permitted under applicable law, and appropriate safeguards are implemented where required.
Where an international transfer is required, Toothpick will apply the relevant legal and regulatory requirements before such transfer takes place.
11. Data Security
We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction. These measures may include, where appropriate:
- Encryption in transit and at rest
- Access controls and role-based permissions
- Authentication measures
- Security logging and monitoring
- Vulnerability management
- Secure software development practices
- Security assessments and testing
- Employee confidentiality obligations
Our security measures are reviewed and updated as appropriate in light of technological developments, the nature of the information processed, and applicable legal requirements. While we take reasonable measures to protect personal information, no method of electronic transmission or storage can guarantee absolute security.
12. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:
- Provide and administer our Services
- Fulfil contractual and transactional requirements
- Resolve disputes
- Enforce applicable agreements
- Satisfy applicable legal or regulatory retention requirements
Retention periods may vary depending on the nature of the information, the Service involved, and the requirements of the jurisdiction in which the Service is provided. When personal information is no longer required, we will securely delete, anonymize, or otherwise dispose of it in accordance with applicable law and our internal retention requirements.
13. Cookies and Similar Technologies
Our websites and digital platforms may use cookies and similar technologies to:
- Maintain user sessions
- Support platform functionality
- Remember user preferences
- Understand how our Services are used
- Protect the security and integrity of our Services
Where required by applicable law, we will obtain your consent before placing non-essential cookies or similar technologies. You may manage certain cookie preferences through your browser or device settings. Disabling certain cookies may affect the availability or functionality of parts of the Services.
14. Your Privacy Rights
Depending on your location and applicable data protection law, you may have certain rights regarding your personal information, which may include the right to:
- Request access to your personal information
- Request correction of inaccurate or incomplete information
- Request deletion of personal information where legally permitted
- Request restriction of certain processing activities
- Object to certain processing activities
- Withdraw consent where processing is based on consent
- Request portability of your information where applicable
- Obtain information regarding certain automated processing activities
- Submit a complaint to the competent data protection or supervisory authority
These rights may be subject to conditions, limitations, or exemptions under applicable law. To exercise an applicable privacy right, please contact Elie Ghosn (Privacy Requests) at
[email protected]. We may need to verify your identity before processing certain requests.
15. Artificial Intelligence and Automated Technologies
Certain features within our Services may use artificial intelligence, machine learning, or other automated technologies to support platform functionality, personalize aspects of the user experience, or provide recommendations.
Where such technologies process personal information, Toothpick will apply appropriate privacy and security safeguards and will use personal information only for permitted purposes.
Where required by applicable law, we will provide relevant information about automated processing that produces legal or similarly significant effects and make available any applicable rights relating to such processing.
16. Third-Party Services
Our Services may integrate with or provide access to third-party services, including:
- Payment gateways and payment service providers
- Financing providers
- Cloud hosting providers
- Identity verification providers
- Analytics providers
- Communication platforms
Where these providers process personal information on Toothpick’s behalf, appropriate contractual safeguards will be implemented as required by applicable law. Certain third parties may act as independent controllers or equivalent responsible parties for personal information they receive directly from you or through a transaction initiated by you. Their processing will be governed by their respective privacy policies and applicable legal obligations.
17. Personal Data Breaches
In the event of a personal data breach, Toothpick will assess the nature and potential impact of the incident and take appropriate measures in accordance with applicable data protection requirements. Where applicable law requires notification to a competent authority or affected individuals, Toothpick will make such notifications within the legally prescribed timeframe.
18. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes to our Services, business activities, or applicable legal requirements. Where changes materially affect how personal information is processed, we will provide appropriate notice through our website, application, email, or another suitable communication channel where required. The most current version of this Privacy Policy will indicate the date on which it was last updated.
19. Contact Us
If you have questions about this Privacy Policy, our processing of personal information, or your privacy rights, please contact:
Data Protection Contact
Elie Ghosn
Address
Abu Dhabi Global Market, Abu Dhabi, United Arab Emirates
20. Applicable Data Protection Laws
Toothpick operates across multiple jurisdictions. The processing of personal information will therefore be subject to the privacy and data protection requirements applicable to the relevant Toothpick entity, Service, and user.
Where mandatory local data protection requirements apply, those requirements will prevail to the extent required by law.
